In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ethtool: keep rtnl_lock for the ioctl self test<\/p>\n
An offline self test that brings the interface down and back up with
\nnetif_close() \/ netif_open() requires rtnl_lock for both. Since the
\nethtool IOCTL path became rtnl-optional for ops-locked drivers, the
\nETHTOOL_TEST ioctl runs holding only the netdev instance lock, so on an
\nops-locked driver the self test now tears the device down without
\nrtnl_lock.<\/p>\n
With lockdep this reproduces deterministically on every offline self
\ntest on such a driver; note the sole lock held is the instance lock, not
\nrtnl:<\/p>\n
WARNING: suspicious RCU usage
\n net\/core\/netpoll.c:207 suspicious rcu_dereference_protected() usage!
\n 1 lock held by ethtool\/107:
\n #0: (&dev->lock){+.+.}, at: dev_ethtool
\n Call Trace:
\n netpoll_poll_disable
\n __dev_close_many
\n netif_close_many
\n netif_close
\n fbnic_self_test
\n dev_ethtool_locked
\n dev_ethtool
\n dev_ioctl
\n sock_ioctl
\n __x64_sys_ioctl<\/p>\n
Without lockdep the same condition trips ASSERT_RTNL() in
\n__dev_close_many() \/ __dev_open(); that check only samples the global
\nrtnl state, so it can be masked by a concurrent rtnl holder, but the
\ndevice is still being reconfigured without the lock it requires.<\/p>\n
The ethtool self_test is a legacy ioctl-only command, so an ETHTOOL_TEST
\ncase is only needed on the ioctl path. Add an opt-in bit for drivers whose
\nself test needs rtnl_lock and set it on the ops-locked drivers whose
\noffline self test tears the interface down and up:<\/p>\n
– fbnic (ops-locked via queue_mgmt_ops): fbnic_self_test() offline path
\n uses netif_close() \/ netif_open().
\n – bnxt (ops-locked via queue_mgmt_ops): bnxt_self_test() offline path
\n goes through bnxt_close_nic() \/ bnxt_half_open_nic() \/
\n bnxt_half_close_nic() \/ bnxt_open_nic(), which close and reopen the
\n device.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ethtool: keep rtnl_lock for the ioctl self test<\/p>\n
An offline self test that brings the interface down and back up with
\nnetif_cl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41091","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}